All right. I know they told me to stay in this little box, but I want to walk among
you. How are you guys doing this morning? Are you awake? Wake? Are you? Prove it. Stand
up. Up, up, up. Everybody up. Not just the heck in the box crew who weirdly listen to
me. I don't understand why this happens every year. So, okay. I make you get up because
I have to be up. And my God, I drank too much last night. So if I have to be up, you have
to be up for just two minutes. So besides the heck in the box crew who have seen me
do this to the audience before, how many of you have been in the security industry for
or security industry or computing industry for five years or less? Okay. So sit down.
Those five years or less. Sit down. Okay. Ten years or less. Sit down. Okay. Now we're seeing
how old I am. I'm still standing. Fifteen years or less. Okay. All right. Wait, wait.
We're dwindling here. So who is left standing up? Okay. Number one, these are people you
need to buy drinks for because we have been through a lot. Okay. Yes. You can all sit
down at this point. So thank you so much for having me again at Hack in the Box. You know,
the crew here, we were talking about it, the other keynotes and I, we're talking about
how much this conference, you know, takes care of you and the crew takes care of you.
And today I'm actually going to talk about essentially a massive, long held social engineering
hack that probably started for me about 18 years ago. My first DEF CON was DEF CON 7.
So yes, you need to buy me all the drinks because I'm very old and clearly I need those
drinks to live because, you know, water isn't doing it for me. But, you know, for me hacking
has been a passion for quite some time and, you know, my career started so long ago in
this industry that there weren't a lot of ways to make money legitimately or otherwise
actually because the early internet didn't have the same dependence that the current
internet has for us as a society. You know, we didn't do any banking online back when
I was learning how to hack, right? We didn't do a whole lot of things that our society
depended on economically, socially and politically. Let's not even go there right now. I'm so
depressed in the United States. But the point was if you knew how to hack a computer back
in the days that I learned how to hack a computer, there were things that you could do with it
that were mostly curiosity bound. And how many of you saw Aaron's talk yesterday morning?
Raise your hands. Yeah. So Aaron did this great, see this is who wakes up in the morning.
You guys are hard core. But, you know, in terms of hacking and what you could do with
it, Aaron did this great walk through, you know, that was inspired by Hollywood and essentially
showing how life was imitating art in terms of hacking. But way back there really wasn't
that much you could do commercially in order to make money if you were a hacker. Certainly
the movie War Games, you know, which started the Reagan administration in the United States
on this path of criminalizing hacking because they were afraid of our super powers. They
were afraid of what we could do. Certainly that was a big moment in hacking history.
However, it was a moment in which our activities were criminalized, not celebrated, not understood,
and ways in which that we might have been able to contribute to the security of our
society were overlooked in favor of fear. And I see this today in terms of legislation
and regulation that is being put in place or is already in place in terms of trying
to deal with our super powers, what they perceive, the normal people in the world perceive as
magic of what we can do. So one of the things that I noticed during my first DEF CON, they
keep telling me not to move across the space, but obviously I just, I can't stand it. I
really want to be with you. So how many of you had a computer when you were a child?
Right? Okay. So there's a generational issue here too as well. How many of you had an old
computer that could only do command line when you were a child? Okay, there we go. So the
thing about it is, is if that's how you had to learn how to use a computer and that's
how you had to learn how to use the internet, there were a lot of things that you had to
do manually that weren't set up for you. And so when we were learning how to do this, we
essentially had to either learn very quickly how these things worked or write something
ourselves that made the computer do what we wanted it to do in order to get what we wanted.
A lot of us got our start in security because we had a younger brother or sister that we
simply wanted to keep out of our files. So that was our first attempt at encryption.
Others of us got into it because we wanted to play a game that we didn't have a license
for and so learning how to use a hex editor to crack a game. But eventually the stakes
became much higher for all of us as our dependence as a society grew on computing, on the internet
itself and on the ability of people like the folks in this room to change the rules at
any given time of what was possible with a computer, with a network and at this point
in our technological growth with anything at all that might have code running on it
and might be on the internet. They call it the internet of things. I feel like that's
going to be a term that goes away very quickly because that is going to just define the internet
just because every single thing that you could have that you want to collect data is going
to be talking to every other thing. And when I look at all of the interconnected devices,
our dependence on it societally, our dependence on it economically and the fact of the matter
is that our society even if you want to opt out of this new interconnected world, let's
say you want to drive a car with not a single microchip in it for the rest of your life,
that's lovely but you will be sharing the road with vehicles that have been designed
to drive themselves and so your safety and the safety of the people that you care about
will be somewhat dependent on dear God the security of a vehicle that may or may not
have been designed to be a computer as well. And we all know how fragile this ecosystem
is especially the old folks that you need to buy drinks for. We all very much, yes see
he needs a drink right now. You just help him out. But we understand the fragility of
this ecosystem and quite frankly it frightens the heck out of me that not only is our society
dependent on it now but there will be no aspect of society where you can opt out anymore and
you cannot opt out of the internet and you can't opt out of security. So the title of
this talk is actually hacking the Pentagon. How many of you heard about hack the Pentagon?
Okay, the crew and my friends in the front row put your hands down and anyone left? Okay,
oh one, two, two people who are not crew or my friends in the front row have heard of
hack the Pentagon. So just to give a little bit of background, I obviously I was a tinkerer,
hacker for a very long time in my life but at a certain point in my career I decided
that I needed to do some hacking that was a little bit higher level in terms of how
much I could affect the world. I certainly could find bugs and I certainly could you
know make my penetration testing clients satisfied because I was able to break into their network
or do all of that stuff but I realized at a certain point especially considering I was
finding the same types of bugs over and over again that one it was getting boring, two
we weren't getting better at security necessarily and three that I might not be able to affect
change and help society as much as I wanted to if I was essentially hacking one bug at
a time, one client at a time. So remember I said that my first Defcon was Defcon 7.
That was in 1999 and we were all kind of rolling up and waiting for the Y2K bug. Has anyone
heard of the Y2K bug? Okay, alright again besides the front row and the crew who is
left in the room, okay so we were concerned about this glitch that was going to affect
so many computer systems worldwide and they had a shortage of programmers who could program
you know in a lot of the languages, COBOL for example, that were running a lot of this
vulnerable code and we were worried that essentially the grid as it were way back then was just
going to come crashing down you know we were worried airplanes were going to fall from
the sky all kinds of things. Hardly any of that happened. There were a few little incidents
that were related to Y2K but think about the computing and interconnectivity that was around
in 1999 versus where we are today in 2016 and you begin to see this picture of that
was viewed as a potential disaster on the horizon because of one bug distributed across
multiple systems around the world and you see the growth of the internet and I would
love to have stats off the top of my head but let's just say it's grown exponentially.
Our dependence on it has grown exponentially. Today we have so many interconnected devices
with often no way to update them. It's not a matter of finding someone who can write
the code and correct the one bug but you know crew and front row you're allowed to raise
your hands for this. Heartbleed, anybody? Yes, you've heard of this. Okay. So heartbleed
is such a great example of where we are now in terms of our state of overall vulnerability
and inability to deal with the issues at hand. Shared library, open source, bug in the code
for more than two years. Couple of people managed to concurrently find that bug. So
proving that if one person found it probably somebody else did as well, that old theory
or of bug collisions but think about what the rollout looked like for dealing with that.
One vulnerability coordination at best between one hacker or one finder and one vendor is
rough sometimes. Imagine vulnerability coordination between hackers, vendors of an open source
library and then the fact that the library itself has to be distributed across the world.
That distribution and that vulnerability coordination took over 100 different companies all trying
to keep a secret that ultimately leaked about a week before the designated date where everybody
was supposed to go live with it. So thinking about the problems with vulnerability coordination
even on a scale like that where it's just trying to deploy a fix for one shared library
and you look at the world of Internet of things and how many of those things have full software
development houses at their disposal, have full testing houses, have automation and testing,
have any kind of security development life cycle, you pretty much come down to almost
no one and then of those IoT vendors, how many of them are using open source libraries?
You come up with most of them. And it's a shortcut way for a lot of these technology
organizations or these non-technology organizations who are suddenly adding code to their devices
and systems to ramp up very quickly and develop something that can suddenly talk to the Internet
when they don't even know what they're doing and they have no way to essentially service
or patch all of these devices. So let's get back to hacking the Pentagon, right? So hacking
the Pentagon, one, I'm amazed that they kept that name, hack the Pentagon. That was a surprise
to probably all of us who were working on this project for the last couple of years.
We would call it that. But what it was was symbolically and effectively the very first
time that the United States government, one, admitted that it needed some help in terms
of cybersecurity, not just saying, no, no, we're secure, trust us, it's fine, all of
your personal data, everyone who's ever applied for a clearance, it's fine, we'll take care
of it. One, it was the first time they were openly asking for help from the hacker community.
Two, it was the first time that they wanted to do anything with the hackers publicly except
throw them in jail. And three, it was the first time that the United States government
was willing to pay people like us for in exchange for vulnerabilities. And you might think that
this was some kind of an impossible task. And it was for sure, definitely. The people
inside the Pentagon who helped make this happen, who were the internal bureaucratic hackers,
Lisa Wiswell, Charlie, Chris Lynch, all of those folks, and Secretary of Defense Ash
Carter himself, who made the decision ultimately to go ahead and do this crazy thing and prove
the fact that not only could the government work with hackers directly, but they could
work with hackers and invite them to hack the actual Pentagon and survive and get better.
That program lasted for about 21 days. It was a pilot program. The Department of Defense
has publicly announced already that they're going to expand that program because what
they found was over 1,400 hackers tried to pre-register for this program. A lot of people
were thinking that this was not going to work, that a lot of my hacker friends actually are
still to this day very suspicious about the whole thing, thinking that they were going
to be registered in this giant government database, they were going to end up in Guantanamo.
Essentially all the paranoia was there, and yet 1,400 different hackers came forward and
wanted to participate in this historic program and have all their names written down and
their social security numbers known and all that stuff. But the fact of the matter was
the United States government wasn't just looking for its bugs, it was looking for people who
were willing to help, people who would actually answer the call when they said, we actually
need your help, hackers, we need your help. So of those 1,400, within I believe it was
13 minutes after the doors opened on Hack the Pentagon that the first vulnerability
report was received. 1,400 people and already less than 15 minutes into the program bugs
started coming in. So looking back at what the Pentagon's goals were, engage the hacker
community, find out about vulnerabilities in some of its websites, and figure out who is
willing to come forward and trust the fact that they would actually come forward when
called to Hack the Pentagon and they would actually turn over the bugs they found. All
of these things had to be met in order for that program to be deemed a success and deemed
a way to move forward in a new way with the hacker community rather than putting them
in jail or threatening them, but in fact embracing them. And I will not forget the fact that
at the end of the program, Secretary of Defense Ash Carter invited a couple of the hackers
up to the Pentagon to stand with him as he talked about the results of the program. One
of them was a high school kid and you know for those of us who have been doing this for
a very long time, can you imagine, can you imagine as we were children that the leader
of one of the most powerful or potentially the most powerful military organization that
the world has ever seen is thanking you for pointing out his weaknesses. Amazing. This
was incredible. So how did this even come to be? The first time I went to the Pentagon,
I was still working at Microsoft. So for those of you who know how long ago I worked at Microsoft,
I left in 2014. I started Microsoft's bug bounties in 2013. That process itself took
me about three years to get Microsoft to agree to pay hackers money. But what had happened
in order to lead up to the Pentagon and this historic moment where you know the leader
of the most powerful military in the world is thanking a child for pointing out his weaknesses
began when I had actually briefed some of the folks inside of a small group at MIT and
Harvard on what I had done to convince Microsoft to allow hackers to hack them and get paid
for it. Now does anybody remember, I think it was back in like 2008 or so, does anyone
remember what Microsoft would say when they were asked about whether or not they would
pay a bug bounty or pay hackers money in exchange for vulnerabilities? Anyone remember? Okay.
No one remembers. That's okay. Microsoft was publicly saying that they would never pay
for vulnerabilities. They said that word. They said never. You know, most mega corporations
usually will hedge around what they say and they don't use absolutes if they can't, if
they can avoid it. And Microsoft was using an absolute saying never. And why was that?
In the Microsoft security response center, how many of you saw Sweetie's talk yesterday?
Did any of you see Sweetie's talk? So Sweetie's talk was, I missed it but I saw the slides.
The slides looked great. It's talking about all the mitigation enhancements to the Windows
10 platform and all the ways in which exploitation techniques are becoming harder to execute
even if you do find a critical vulnerability on the platform. But going back to 2008, Microsoft
executives were saying they were swearing that they would never pay money. What was
going on? What was causing them to believe that they would never have to do that? Well,
in the Microsoft security response center, they were receiving over 200,000 non-spam
email messages per year of friendly hackers who were volunteering for free to tell Microsoft
about its weaknesses. So with that data, they were thinking, well, you know, all these friendly
hackers who want to see the world being a safer place, these friendly hackers are willing
to come forward for free. Rule number one, always silence your own phone when you're
using it. Okay, there we go. Actually, the day I announced the Microsoft Bug Bounty programs,
I was on stage in Bangkok and I heard a phone ring going off and it was going off and I
was thinking, wow, somebody really needs to silence that thing. And then I realized it
was a Windows phone ring and then I realized the only person whose phone it could possibly
be was mine. So I had to go, well, okay, there was maybe one other person in the room whose
phone it could possibly be, but essentially my own alarm was going off on stage the day
that I was announcing the Microsoft Bug Bounty programs. And actually, Dylan and Belinda
were there with me. It was an amazing day. But so how did I get Microsoft from this position
where they were receiving so many bugs for free, where they were receiving tons of critical
and critical vulnerabilities for free, even when there was an exploit and vulnerability
market that was alive and well where all of these bugs were getting bought by other parties,
whether they were defensive parties like the Zero Day Initiative. How many of you have
heard of ZDI? Okay, great. So Zero Day Initiative and other kinds of vulnerability acquisition
programs like it are defense oriented in that they will buy the vulnerability in order to
get it fixed. They will buy it, they will give it to the vendor to fix it, they will
maybe build a product or an alerting service or something around the fact that they've
acquired these unknown vulnerabilities, but that's the defense market for vulnerabilities.
The offense market for vulnerabilities is something entirely different. The offense
market is buying vulnerabilities and exploits in order to keep them secret, in order to
use them for attacks, in order to keep them live and, you know, viable for as long as
possible. So they're not just buying the vulnerability, they're actually buying exclusivity. How
many of you have heard what happened with hacking team? Any of you heard of hacking
team? Okay, great. So hacking team was a great example of how the offense market really worked.
You saw in the email dumps of hacking team that vulnerability or exploit sellers were
offering a range of vulnerabilities and they were offering priceless price breaks if you
bought a bundle, you know, bargain, bargain bugs, and they were also offering exclusivity
of the vulnerability itself by tripling the price. They also had a payout schedule that
was very nicely documented saying, you know, if you buy this bug, give me 50% of the money
upfront and then pay me out 25%, 25% one month later and then the last month later and you
don't have to pay if the bug essentially gets patched or something else happens to make
it less viable for attack. So you begin to see the reason why some of the prices for
vulnerabilities seem so high in the offense market versus the defense market is because,
again, they're not paying just for the vulnerability, they're paying for the hacker's silence. They're
paying for the ability to use this thing for offense for as long as possible. So let's
get back to Microsoft, right? So Microsoft's getting all of these bugs for free. Sounds
great. Sounds like a reason to vow never to pay hackers money. However, there was this
pesky thing that I had access to which was vulnerability reporting data inside of Microsoft.
And one of the things that was very important to Microsoft was that it had not just this
pipeline of free bugs, but it had a pipeline of potential recruits of hackers who it might
be able to hire to help make its products more secure. This direct interaction with
hackers potentially for recruiting was very important to the biggest software company
in the world. Famously, let's see, there was a hacking group in Poland that some of the
early folks at Microsoft security years before I was ever there went to go visit because
they had found some serious vulnerabilities. They went to go visit them to recruit them.
Some of those folks still work at Microsoft to this day, 15 years later, trying to help
make those products more secure. So the data that I had was showing that not only, yes,
the bugs were still coming in, but more and more of the bugs, the critical bugs in critical
software like Internet Explorer were coming in through zero day initiative or other defense
market brokers. So what did that actually do? It cut off access that Microsoft had directly
to the hackers. This is bad. It also did something that Microsoft didn't like, which was put
a time limit on a fix. Yeah, they hate that. So there were two kind of undesirable things
that were happening, even though they were getting the bugs, even though somebody else
was paying for them, and even though, you know, generally speaking, at least 180 days
would pass before anybody dropped the ODA in this little defensive ecosystem, they realized
that they wanted to actually change those trends to regain direct access to that hacker
community that's capable of finding those bugs, to be able to control, you know, essentially
the timeline because of who might know about the vulnerability. And the one piece of data
that I showed the IE team that ended up knocking over the last of the objections of Microsoft
was data. So IE would go through a public beta period where they would release, you
know, a less than stable version of the software in order for the customers to go ahead and
test it in their environments. Microsoft engineers were fixing as many bugs as they could during
this beta period. So what was happening with all these free, you know, free bugs that the
hackers were giving Microsoft? How many of them do you think were coming in during the
beta period? You want to think 40, 50 now, right? Actually very few. So there was usually
very few vulnerabilities coming in. And then when would they come in? There was a giant
spike after the final release of IE, the release to manufacturing. So after RTM, huge spike
of incoming vulnerabilities. What did that mean? Well, the incentives at that time for
these hackers to come forward with free bugs that Microsoft was offering was 10 point aerial
font and their name in a bulletin. So that was the only incentive that a hacker had.
Now if a bug is fixed during the beta period, chances are unless it also affected down level
versions, you weren't going to get your name in a bulletin. So hackers had inadvertently
been trained by Microsoft to hold on to their bugs until the worst possible time to tell
Microsoft, which is after you're out of the beta period. So I showed the head of IE this
big spike at the worst possible time for engineering for him. And I said, look, all we need to
do is provide an incentive for these hackers who are going to help us anyway to come forward
earlier in the beta period. And we can do this traffic shaping exercise and we can move
this spike of vulnerabilities and give you guys the maximum amount of time to fix it.
I didn't get through my little 12 slide presentation to the head of IE. I got to slide two and
he literally said to me, yes, yes, yes, I'm going to make it easy for you. How much? That
was literally what he said. And I sat there after two and a half years at that point,
two and a half, almost three years, I sat there saying, wait a minute, did that just
happen? Did he just, did he just offered a back a truck of money up to the Microsoft
Security Response Center and pay for his bugs? And in fact, that is what happened. Because
just because he wanted to align what he knew the hacker community was going to do anyway,
which is look for bugs, he wanted to align what he knew the friendly hackers were going
to do anyway, which is turn them over to Microsoft to get them fixed. He wanted to align all
of these activities that were inevitable with his schedule and he was willing to pay for
it. So that was that. And that finally ended Microsoft's longstanding aversion to paying
hackers money directly for vulnerabilities. Finally, there was a reason to channel the
hackers' eyes, channel their energy and point them at the product they wanted to find out
about, which is the latest product, at the time they wanted to find out about those bugs
in a most advantageous way for engineering and then ultimately for the customer, which
was the earliest part of the beta period of that product. So something else that I was
able to start at that time was not just an individual bug bounty that was time based
deliberately and and orchestrated to move that big spike of traffic. How many of you
have heard of the mitigation bypass bounty at Microsoft? It's the $100,000 bounty that's
been going for the last three years. Yeah. So at the time you could go to Pwn2Own and
that year you could get $100,000 was the top prize at Pwn2Own that year for coming up with
an exploit that would bypass all of the mitigations of any given platform target. You get $100,000
if you did the live exploits at that moment during the contest. What I was able to convince
Microsoft to do was not have a contest once a year, but essentially having an ongoing
six figure bounty that wasn't necessarily for a single exploit, but it was for something
more valuable to Microsoft and that was for a mitigation bypass technique. How many of
you have heard of return oriented programming? Okay. How many of you have heard of Jitspray?
All right. Slightly fewer, but it's okay. These are all representative examples of mitigation
bypass techniques. So whether you find a vulnerability and whether you're able to exploit it are
two very different things, right? Especially as modern platforms have been made more and
more secure. So why would an organization like Microsoft want to learn about mitigation
bypass techniques as early as possible? Does anyone have a guess? That's okay. We'll guess.
You know what? We'll guess at karaoke later. It'll be more fun. You know that's happening
tonight. I'm just inviting you all at this moment. So the reason Microsoft needed to
know about it as early as possible is because to create new mitigations to combat those
exploitation techniques takes not just a patch Tuesday, it takes rearchitecture of the platform
on some level. And that is something that usually takes an operating system company
several iterations to change. And it's not because they're slow and they don't know how
to fix it. It's because all the applications that run on top of the platform all have to
have time to adapt to the new way that the operating system works. So it's essentially
an issue of future thinking engineering to make exploitation harder because of what you've
learned about today of how exploitation works on the platform today. These are much longer
term fixes. And Microsoft essentially needed to know about these new techniques as early
as possible to plan how they were going to deal with it for the next version or maybe
even the version after that of the operating system. Now remember I was talking about those
those different markets and how you know they often will pay for exclusivity in very high
prices. How many of you think that Microsoft was competing directly on price with these
markets? Does anybody really think that? Great. You don't think that or you've fallen asleep.
I need to run around you a few more times. Okay. But the fact of the matter is they didn't
need to compete directly on price not for those IE vulnerabilities that were critical.
By the way how many vulnerabilities do you think were collected in that one month bug
bounty period at the beginning of the IE 11 beta release? Anyone want to guess? Four?
Can someone say four? Yeah? Okay. How much money do you think Microsoft would have had
to pay to get those four maybe critical vulnerabilities? One million dollars? No I didn't hear that
out there. Okay. No actually what happened was even though each of those vulnerabilities
there were 18 by the way vulnerabilities that came in that were valid and what we would
call bulletin class so they were important or critical vulnerabilities. 18 of them came
in in one month. About $28,000 total was spent to collect those 18 vulnerabilities. Now why
do you think you know it was possible for Microsoft to get these for such a low price?
Well think about those other markets. When the offense market wants to buy a bug they
want to be able to use it for a tax. Why would they buy a bug during the beta period of software?
Why would they spend six figures on an exploitable vulnerability that may evaporate in next week's
you know test a new release of the beta software? So they wouldn't. So essentially there was
a gap in the market there. Now going back to the $100,000 mitigation bypass bounty. Yes
there was that same price for the Pwn2Own contest that year but remember that was just
offering $100,000 for working exploit and it could use one of those existing exploitation
techniques like return oriented programming or jet spray or whatever it was. Didn't need
to come up with a brand new technique in order to claim that $100,000 in that once a year
contest. So what was Microsoft thinking you know in terms of will they have anybody who's
willing to come forward with this very very valuable technique? Again think about who
the adversary is and what their goals are. The adversaries goals are to buy these things
that will work for as long as possible but do they need it to leverage a brand new exploitation
technique in order for it to be effective or worthwhile for them? No because the existing
exploitation techniques were working. Working just fine. So they didn't need to make that
additional investment in trying to find these new exploitation techniques. The only party
that was going to benefit from acquiring these new techniques was going to be the operating
system manufacturer itself. Hence how I was able to convince Microsoft to not just buy
its own bugs in terms of IE but buy these new exploitation techniques at what was until
Apple's bug bounty the highest ongoing vendor bug bounty or vendor technique bounty essentially
that had been an unbroken record for the last three years. It's $100,000 ongoing with no
time limit and no end. Anyone want to guess what the rate of Microsoft's learning about
new exploitation was? How often would they come across a new exploitation technique through
other means? Either disclosure from research or from attacks in the wild. Anyone want to
guess how often that would happen before that bounty? No one wants to guess. I'm going to
have to run among you again. Okay. But actually it was about once every three years. And that
corresponds with the release of the operating systems at that point. The new mitigations
would come out. Some security researchers and or some attackers would research the ways
that Microsoft had tried to harden the platform and make exploitation harder. And then you
would become aware of new exploitation techniques once every three years. Does anyone want to
guess at how many times the $100,000 mitigation bypass bounty has been paid out in the last
three years? Well, it's not once. They paid out over half a million dollars in this ongoing
bounty. Because the hackers who are capable of thinking their way around the latest mitigations
often weren't doing it for the money necessarily. They might be doing it for the recognition,
but they were definitely doing it for what I call the pursuit of intellectual happiness.
And they were curious to see if they could defeat these mitigations. And Microsoft was
inviting them to go ahead and do so and offering them a six figure amount and all the publicity
they could possibly stand for being helpful in this ecosystem. So fast forward, how did
this actually factor in to the Pentagon? So I had given a lecture about all of these different
mechanisms that I was employing at Microsoft in order to intentionally disrupt some of
the dynamics in the vulnerability and exploit market and intentionally bring in some of
these bugs at certain times, some of these techniques at a faster rate, and all of these
things. And I had given this lecture and somebody from the Pentagon happened to be in the room.
So that was the first time I was invited to the Pentagon. So I gave the same lecture essentially
to a room full of people in the Pentagon. And one of the things that I noted was, you
know, as with any military organization in the modern world, there certainly were people
who were in that room who were interested in what I was doing because they were annoyed
because it was going to make their offensive job harder. I don't know who they were. I
couldn't identify them. But the offense arm of, you know, the biggest military in the
world was in that room. But the defense arm was too. And so the conversations that were
started at that point became conversations I was having over the next couple of years,
even as I left Microsoft, even as I went to my former startup company that does bug bounties,
the conversations accelerated this past fall. And the reason they did was because something
called the digital defense service was started inside the Pentagon. Now, if you go into the
Pentagon and you find DDS, well, or someone leads you there, they actually have a little
plaque under the door that says Rebel Alliance, Star Wars style, right? So you go in and they
basically say welcome to the Rebel Alliance. They've got, you know, little BB8 logos on
the sides. It's an open seating environment. And they've got hackers and programmers from
some of the most interesting technology companies who are doing rotations in this place. And
the whole purpose is to accelerate the Department of Defense's acquisition and utilization of
modern technology and modern security techniques. So this brand new group that had been created
for the purpose of accelerating, you know, or accelerating the Pentagon's adoption of
technology much faster than the usual acquisition time cycles of software, that was the group
that ended up spearheading on the inside the creation of Hack the Pentagon. Because essentially
they were told do things better, do things faster. And I believe in my purse is the card
of Lisa Wiswell that literally says under her title, and this is an officially issued
card from the Pentagon, get shit done. It says it on her card. So how cool is that?
They were given the license to try and experiment with technology and try and experiment with
some of these proven techniques that were in the software security world for acquiring
vulnerability information and interacting with the hacker community. So the time was
right. They were ready to essentially launch, you know, their, launch their rebel, their
rebel mission. And I remember getting the call from the Pentagon saying good news, we're
going to go forward with this. And I thought this is insane. Why is this happening? Am
I dreaming? I'm asleep. What time zone am I in? I have no idea. How could this even
be true? That after all this, they're finally ready to allow hackers to hack them. And so
how many of you actually, you know, kind of saw the unfolding of the actual Hack the Pentagon
challenge, the 21 days and everything? A couple of you, yeah. So what that ended up being
was it was a pilot, right, to prove the concept, to oil the gears of the people receiving the
vulnerability reports and needing to fix the issues on the back end of the Pentagon. It's
21 day period. And they not only got all of these vulnerabilities, I believe it was 138
vulnerabilities that they paid $70,000 for total. But they also got that precious access
directly to the hackers. And Ash Carter inviting that child to come stand beside him at the
podium to shake his hand in the secret coin passing ceremony of how they give you challenge
coins, you know, in the military is supposed to be silent in person and with a handshake.
So if you watch that video, you can see Ash Carter kind of getting the coins and shaking
the hands of the people who are on stage with him, including this child. At the end of it,
not only did Secretary Carter announce how successful the program was, but he announced
that it was going to continue and expand. This experiment that 35 years ago when the
movie War Games, you know, was coming out and scaring President Reagan into making hacking
a federal crime, from that moment all the way until Secretary Carter is thanking hackers
and asking more of them to come forward and help seems like an impossible thing. But given
the fact that a long time ago when I was hacking computers, that moment where I decided that
changing the world one bug at a time wasn't going to be enough, figuring out how these
systems worked, how the objections of these large organizations worked became my new hacking
mission. And essentially that was what ultimately caused not just Microsoft, not just the Pentagon,
but we're seeing more and more of this revolution where huge organizations and governments are
realizing not just the need to work with hackers, but that it's actually quite advantageous
to them to do so and that they can't possibly meet the challenges of today or tomorrow without
us. So they've restarted my timer like five times. What I'm going to do at this moment
is give you about, I think, maybe two minutes to ask me some questions. If you're shy, we
can take the questions out into the foyer. But really, I mean, what is this about? I
told you about how I was able to reverse engineer all of the objections of these large organizations
and in fact exploit the mutual benefit of being able to work with hackers directly and
in fact pay the money. But what does this have to do with you? How many of you are in
organizations that are considering a bug bounty program? None. You will not admit it. Okay.
How many of you are in organizations that are capable of receiving a bug report from
the outside? God, so few. So one thing was interesting. So I mean, just for people who
will watch this later, there were about five hands that went up in this room. That does
not surprise me. One of the most interesting pieces of data from my former company was
they looked at the Forbes top 2000 companies. These are companies that make billions of
dollars in revenue. They spend millions of dollars on security. They do all their compliance
stuff. 94% of the top 2000 companies, according to Forbes, 94% had no published way to receive
a vulnerability report. They had no email address like secure at Microsoft. They had
no web form. They had no page on their website that even said, we want to hear from you hackers.
Tell us about our weaknesses. 94%. Only 6% had something at all. Of the fortune 100 companies,
six of them have bug bounty programs. So what does this all mean? This means that the world
is not quite ready for bug bounty programs because the world is not quite ready to even
hear from you. So what I would say to that before I actually let you ask me questions
is think about all of the ways in which an organization actually needs to prepare to
receive the bountiful blessings from the hacker community, which are bugs. And help them understand
that essentially there are only three ways to learn about your vulnerabilities. You can
hire pen testers or hire really smart people to work for you and find them yourself. Somebody
friendly on the outside, like a partner or a customer or a hacker, can tell you about
it. Or you can be attacked. Now, of those three methods, logically, why would you ever
want to cut off one of them? So with that, I would like to thank Dylan, Belinda, the
Hack in the Box crew, I would like to thank all of you for waking up and standing up and
entertaining me at least for the last hour or so. And I would also like to open it up
for questions. But at the end of the day, I mean, we are the ones who have created this
technological world that we depend on. And we're the only ones who can secure it. So
thank you so much. Questions from the floor? Don't be shy. I'm not singing yet. Okay, that's
not a question you can ask. But I will take requests later. So what time is karaoke? Great
question. What time is karaoke? After whatever the party is tonight, there will be karaoke.
No, I mean, in all seriousness, I know you may be shy and you might have, but nobody
wanted to raise their hand when I asked, you know, how many of your organizations are thinking
about bug manies and then how many of your organizations can even receive bugs. You probably
have a lot of shy questions you want to ask me in the hallway. And that's okay. I'm pretty
easy to find on the Internet. But I want to thank again the crew and all of you for waking
up and being with me and indulging me this morning. And now remember, who were those
folks stand up one more time the last group of people who had been doing computers security
for the last 15 years or more that last group of people stand up again. Come on. I know
I'm standing. All right, these folks give them a hand because and buy them drinks because
my God, we've had so many reasons to drink ourselves to death in the last 15 or so years,
is by them by them water as well. Again, thank you so much. Thank you very much Katie.